Internal Audit vs External Examination for Regulatory Compliance

SY0-701 By islever Editorial Last updated

Explain types and purposes of audits and assessments.

Short answer

B Use an internal audit to proactively evaluate and understand how company security policies align with external regulatory requirements.

Question

The Chief Information Security Officer (CISO) at a large company would like to gain an understanding of how the company's security policies compare to the requirements imposed by external regulators. Which of the following should the CISO use?
  1. Penetration test
  2. Internal audit Correct Answer
  3. Attestation
  4. External examination

Key Takeaways

The exam often traps candidates with 'external' keywords, but the goal of gaining an internal understanding mandates an internal audit rather than a third-party examination.

This question tests the distinction between internal and external compliance assessments. The correct answer is B because an internal audit allows the organization to proactively evaluate its own security policies against external regulatory requirements.

Common mistake: Candidates frequently choose D (External examination) because they associate 'external regulators' with an 'external' review, ignoring that the CISO needs to perform the assessment themselves first.

Expert Analysis

Why the Answer Is Correct

An internal audit is a structured evaluation conducted by or for the organization to assess controls against specific criteria, including external regulations. Since the CISO wants to "gain an understanding" of the current state of compliance, performing an internal audit is the appropriate proactive step to identify gaps before any official external scrutiny occurs.

Why the Other Options Are Wrong

Penetration testing (A) focuses on technical vulnerabilities, not policy alignment. Attestation (C) is a formal declaration of compliance, usually provided to a third party, not a tool for self-assessment. External examination (D) is typically performed by regulators or independent auditors after internal processes are established; it is not the primary tool for an organization's initial self-evaluation.

Community Comment Notes

Many users initially selected D due to the word "external," but as Ty13 noted, "External audit to compare against external regulations" is a trap when the goal is internal understanding. Multiple commenters correctly identified that an internal audit is a comprehensive evaluation of policies against both internal and external standards.

Exam Strategy

Always look for the actor performing the action. If the organization is evaluating itself ('gain an understanding'), use Internal Audit. If a regulator or third party is conducting the review, use External Examination or Audit.

Frequently Asked Questions

Why not use an external examination since the regulations are external?

External examinations are typically mandated by regulators or performed by independent third parties. An internal audit is used by the organization to self-assess and prepare for such events.

Is attestation different from an audit in this context?

Yes. Attestation is a formal statement or certification of compliance, whereas an audit is the process of reviewing and evaluating the controls to determine if those statements are true.

More SY0-701 FAQ →

Community Votes

B
62%
D
38%

62% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 18 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 18

  1. 01a4c2e 👍 7 Answered B
    Ty13 2 weeks, 2 days ago B. Internal Audit I know people want to select D because... it sounds right. External audit to compare against external regulations. But there's a part being overlooked: 'would like to gain an understanding'. Which you don't NEED a third party to confirm, because the company already KNOWS those regulations. But you WOULD need an external audit if there was a large breach and the regulatory agencies wanted to know how it happened. What is being asked, effectively, is "Can an internal audit team verify that we meet external regulations?"
  2. a4e15bd 👍 4
    B. Internal Audit An internal audit involves a thorough review of the company's policies and procedures to ensure they meet the regulatory requirements and industry standards.
  3. myazureexams 👍 4 Answered D
    It is D period. And for the exam, make the association "External with External" DONE
  4. baronvon 👍 3 Answered B
    B. Internal audit An internal audit allows the CISO to assess how the company's security policies align with the requirements imposed by external regulators. This process involves reviewing and evaluating the company's policies, procedures, and controls to ensure compliance with regulatory standards.
  5. laternak26 👍 2 Answered B
    An internal audit is a comprehensive evaluation of a company's operations, processes, and policies to ensure they are compliant with internal standards as well as external regulations. In the context of comparing the company's security policies to external regulatory requirements, an internal audit would be the most appropriate tool. It involves reviewing and assessing the security measures and procedures in place and determining how well they align with legal and regulatory requirements, ensuring that the company meets compliance standards. Why not D. External examination: An external examination is typically performed by third-party auditors or regulators to assess compliance with external standards and regulations. While it can provide valuable insights into regulatory adherence, it is not the best tool for an internal review by the CISO. An internal audit allows the CISO to assess the company's own security policies and their alignment with external regulations before seeking an external review.
Show 13 more comments
  1. Ty13 👍 2 Answered B
    B. Internal Audit I know people want to select D because... it sounds right. External audit to compare against external regulations. But there's a part being overlooked: 'would like to gain an understanding'. Which you don't NEED a third party to confirm, because the company already KNOWS those regulations. But you WOULD need an external audit if there was a large breach and the regulatory agencies wanted to know how it happened. What is being asked, effectively, is "Can an internal audit team verify that we meet external regulations?"
  2. Murtuza 👍 2 Answered D
    Between the two options, D. External examination is the most suitable for understanding how the company’s security policies compare to external regulatory requirements. An external examination involves an independent review by an external party, providing an objective assessment of the company’s compliance with regulatory standards. This ensures that the evaluation is unbiased and thorough, which is crucial for regulatory compliance.
  3. ProudFather 👍 2 Answered D
    D. External examination An external examination by a qualified third-party auditor can provide an objective assessment of the company's security practices against industry standards and regulatory requirements. This can help the CISO identify any gaps or weaknesses in the company's security posture and take corrective action. The other options are not as suitable:
  4. nillie 👍 2 Answered B
    The CISO should use: B. Internal audit An internal audit is a structured assessment of the company's security policies, processes, and controls to ensure they meet both internal standards and external regulatory requirements. This will help the CISO understand how well the company's security policies align with the requirements imposed by regulators.
  5. e2ba0ff 👍 2 Answered B
    vendor's self-assessment of practices against industry or organizational requirement
  6. Glacier88 👍 1 Answered D
    External examination: An external examination, conducted by an independent third party, can provide an objective assessment of the company's security policies and practices against external regulatory requirements. This can help the CISO identify any gaps or areas for improvement. Penetration test: While penetration tests can identify vulnerabilities in the company's security infrastructure, they don't directly assess compliance with external regulations. Internal audit: Internal audits can assess the company's adherence to internal policies and procedures, but they might not provide a comprehensive view of compliance with external regulations. Attestation: Attestation is a formal process of providing assurance about a specific claim or assertion. While it might involve compliance with regulations, it doesn't necessarily provide a full assessment of the company's security policies and practices.
  7. Rackup 👍 1 Answered D
    Answer: D. External examination Explanation: An external examination is the best approach for the CISO to gain an understanding of how the company's security policies compare to the requirements imposed by external regulators. This process typically involves an external party, such as a third-party auditor or regulatory body, reviewing the company's security policies and controls to ensure they align with industry regulations and standards. While internal audits (B) assess the company's internal controls and practices, external examinations provide an unbiased review from an external perspective, which is essential for understanding compliance with external regulatory requirements.
  8. ijia_Ai0823 👍 1 Answered B
    In my opinion, it's Internal audit. It's more likely to be a sequential things (Based on an ISO-9001 external audit I experienced before). A company usually do an internal audit before proceeding to an external audit, because external audit must have a authorized third-party auditors and can be quite costly to be certified that your company is qualified by the auditors. In most cases, the auditors may conclude some corrective actions(like CAR) that need your company to finish. After the correction report is submitted and validated by the auditors, your company can receive the approved certification.
  9. Dlove 👍 1 Answered D
    D. External Examination An external examination involves a review or assessment conducted by an independent third party, often to evaluate how an organization's policies, procedures, and practices align with regulatory requirements or industry standards. This process is crucial for identifying gaps between the company’s internal security policies and the requirements imposed by external regulators. It provides the CISO with an unbiased understanding of the organization’s compliance status.
  10. Suga_1 👍 1
    The correct answer is: C. Attestation. Explanation: Attestation: This involves an independent third party verifying that the company's security policies, processes, or systems meet the requirements imposed by external regulations. Attestations are often used to demonstrate compliance with regulatory frameworks and standards such as SOC 2, ISO 27001, or GDPR.
  11. RIDA_007 👍 1 Answered D
    An external examination (also known as an external audit or external review)
  12. Cyber_Texas 👍 1
    D external examination is best here
  13. NONS3c 👍 1 Answered B
    even GPT Said

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide